dank/serverAppConfigs
1
0
Fork 0
Code Issues 6 Pull Requests Actions Packages Projects Releases Wiki Activity

open-webui: flip to SSO-only (disable local login form + password auth)

Browse Source 
The authentik OIDC round-trip is verified, so retire the local
username/password path. ENABLE_LOGIN_FORM hides the form and
ENABLE_PASSWORD_AUTH refuses password logins; the only way in is now
the OIDC flow, which folds into the local account by email. The
ui.enable_login_form config-DB override is flipped to false in the
same change (the DB wins over env, so both must agree).
This commit is contained in:
Frank
2026-09-24 20:52:06 -07:00
parent 66a5e39899
commit 33cdeca41e
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dankclaw/open-webui/quadlet/open-webui.container
+8
View File
@@ -56,6 +56,14 @@ Environment=ENABLE_OAUTH_SIGNUP=true
Environment=OAUTH_MERGE_ACCOUNTS_BY_EMAIL=true
Environment="OAUTH_SCOPES=openid email profile roles"
Environment=ENABLE_OAUTH_ROLE_MANAGEMENT=true
# SSO-only (2026-09-24): the OIDC round-trip is verified, so the local
# username/password path is retired. ENABLE_LOGIN_FORM hides the form;
# ENABLE_PASSWORD_AUTH refuses password logins entirely, so the only way in
# is the authentik OIDC flow (which folds into the local account by email).
# The per-key config DB override (ui.enable_login_form) is flipped to false
# in the same change — the DB wins over env, so both must agree.
Environment=ENABLE_LOGIN_FORM=false
Environment=ENABLE_PASSWORD_AUTH=false
# Web search -> SearXNG, reached over the host-published port (NOT the
# search.franksdank.cloud vhost): the Anubis->Authentik guard chain is a